tonyair/silverstripe-reports
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-reports synced 2024-10-22 11:05:53 +02:00
Code Issues Projects Releases Wiki Activity

FIX Do now allow arbitary class creation in CMS

Browse Source
This commit is contained in:
Stephen Shkardoon 2014-03-19 19:27:39 +13:00
parent 7002dcfa7f
commit a67ed2799d
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
code/controllers/CMSMain.php
View File

@ -871,7 +871,16 @@ class CMSMain extends LeftAndMain implements CurrentPageIdentifier, PermissionPr
* @uses LeftAndMainExtension->augmentNewSiteTreeItem() * @uses LeftAndMainExtension->augmentNewSiteTreeItem()
*/ */
public function getNewItem($id, $setID = true) { public function getNewItem($id, $setID = true) {
$parentClass = $this->stat('tree_class');
list($dummy, $className, $parentID, $suffix) = array_pad(explode('-',$id),4,null); list($dummy, $className, $parentID, $suffix) = array_pad(explode('-',$id),4,null);
if(!is_subclass_of($className, $parentClass) && strcasecmp($className, $parentClass) != 0) {
$response = Security::permissionFailure($this);
if (!$response) {
$response = $this->response;
}
throw new SS_HTTPResponse_Exception($response);
}
$newItem = new $className(); $newItem = new $className();

23
tests/controller/CMSMainTest.php
View File

@ -328,6 +328,27 @@ class CMSMainTest extends FunctionalTest {
$this->session()->inst_set('loggedInAs', null); $this->session()->inst_set('loggedInAs', null);
} }
public function testGetNewItem() {
$controller = new CMSMain();
$id = 'new-Page-0';
// Test success
$page = $controller->getNewItem($id, false);
$this->assertEquals($page->Title, 'New Page');
$this->assertNotEquals($page->Sort, 0);
$this->assertInstanceOf('Page', $page);
// Test failure
try {
$id = 'new-Member-0';
$member = $controller->getNewItem($id, false);
$this->fail('Should not be able to create a Member object');
} catch(SS_HTTPResponse_Exception $e) {
$this->assertEquals($controller->getResponse()->getStatusCode(), 302);
}
}
} }
class CMSMainTest_ClassA extends Page implements TestOnly { class CMSMainTest_ClassA extends Page implements TestOnly {
@ -344,4 +365,4 @@ class CMSMainTest_NotRoot extends Page implements TestOnly {
class CMSMainTest_HiddenClass extends Page implements TestOnly, HiddenClass { class CMSMainTest_HiddenClass extends Page implements TestOnly, HiddenClass {
} }